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^ I ABSTRACT: We describe an array of quantum gates implementing Shor's al- 

gorithm for prime factorization in a quantum computer. The array includes a 
circuit for modular exponentiation with several subcomponents (such as controlled 
^ I multipliers, adders, etc) which are described in terms of elementary Toffoli gates. 

We present a simple analysis of the impact of losses and decoherence on the perfor- 
O ■ 

\Q • mance of this quantum factoring circuit. For that purpose, we simulate a quantum 

G^ ■ 

computer which is running the program to factor = 15 while interacting with 
0-i, a dissipative environment. As a consequence of this interaction randomly selected 

pH . qubits may spontaneously decay. Using the results of our numerical simulations 

^ ' we analyze the efficiency of some simple error correction techniques. 



1. Introduction 

In recent years there has been an explosion of activity in the area of quantum 
computation (see Ref. 1,2). In part, this was a consequence of a very important 
discovery made in 1994 by Peter Shor, who demonstrated that two problems which 
are thought to be classically intractable (finding prime factors and discrete log- 
arithms of integer numbers) could be efficiently solved in a quantum computer 
[3,4]. Shor's results added a practical motivation for the study of quantum com- 
putation which, until that time had received the attention of a smaller community 
of people interested in fundamental aspects of quantum mechanics, the physics of 
information, algorithmic complexity theory, etc. By now, quantum computation 
is a growing field which is developing not only due to the work of theorists but. 



fortunately, also due to recent advances in experimental techniques. In fact, in the 
last two years there have been a few interesting experiments aiming at constructing 
quantum gate prototypes (see Ref. 5,6,7). 

There are many open questions concerning the mathematics and also the physics 
of quantum computers. In fact, we still don't know what is the real power of 
quantum computation from the algorithmic complexity point of view. (Until now, 
attempts towards demonstrating their usefulness to solve NP-complete problems 
were not successful.) On the other hand, the physics of quantum computers also 
presents many important challenges. Among the most important open questions 
is the understanding of the impact of the process of decoherence (an issue that 
attracted some attention over the last two years [8,9,10,11,12]). Decoherence 
[13] is a physical process by which the quantum interference effects, essential for 
the proper functioning of the quantum computer, are destroyed by the interaction 
between the computer and its environment. This interaction creates irreducible 
computer-environment correlations which, as the environment is unobserved, in- 
duce the dynamical collapse of the computer's wave function. Decoherence may 
be potentially devastating but, as recent studies suggest, there may be ways in 
which one can reduce the problem. For that purpose, a few ideas have been ad- 
vanced. Shor proposed a procedure for recovering quantum coherence by using 
coding [14] (see also Ref. 12), and similar methods have been proposed for "pu- 
rifying" entangled pairs before using them for transmiting quantum information 
through noisy channels [15]. This, combined with the possibility of building error 
correction schemes based on the "watchdog" effect [16] are promising ideas that are 
currently under investigation. 

However, to give a specific answer to the question of how important is decoher- 
ence for factoring one needs to be rather specific. The answer will depend upon the 
computer implementation (hardware) and also on the particular algorithm (soft- 
ware) used. For example, the possibility of implementing error correction schemes 
based on watchdog effect depends upon having a computer evolving in such a way 
that at some known instants it is in a known state (or at least some qubits are in a 
known state, so that we can measure them without disturbing the computer). The 
aim of this paper is to begin a study on the impact of dissipation and decoherence 
on a quantum factoring computer. For this purpose we design a quantum factor- 
ing circuit analyzing how its performance is affected when the interaction with an 
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environment is included. 

Several recent papers are related to ours: Chuang et al. [10] described on gen- 
eral grounds the potentially devastating effects that decoherence may have upon a 
factoring computer. Their results, which were obtained using a simple description 
of the quantum computer, which makes no reference to a specific quantum cir- 
cuit, suggest that by having a low enough decay rate and using appropriate error 
correction techniques one may be able to implement factoring in a quantum com- 
puter. Cirac and ZoUer [5] presented a numerical study of the effects of errors on 
the quantum Fourier Transform (FT) subroutine, which plays a central role on the 
factoring program. Their simulation was done by considering the effect of spon- 
taneous decay while a computer made of cold trapped ions runs the FT program 
(previously designed by Coppersmith and others [4,17]). Other studies of deco- 
herence on quantum computers have been presented which are not directly related 
to the issue of factoring. For example, the importance of losses and decoherence 
have been analyzed [18] for the optical quantum computer designed by Chuang 
and Yamamoto [19] to solve Deuscht's Oracle problem [20] for a one bit function. 
The effect of decoherence upon a static quantum computer was also analyzed in 
Ref. 8,11. 

The paper is divided in two parts: We first present an array of reversible quan- 
tum logic gates which implements Shor's algorithm for factoring integer numbers in 
a quantum computer. To do that we first created subcomponents which some spe- 
cific tasks such as controlled multiplication, controlled sums, mod(N), etc. Then, 
we combined these subcomponents in the precise way required to run Shor's al- 
gorithm. The existence of work-qubits (required to handle the reversible logic) 
makes the design of the quantum circuit a rather nontrivial task. In fact, for the 
quantum computer to work properly, it is necessary to reversibly erase the records 
created along the computational path (stored in the work-qubits). As an exam- 
ple, we present the gate array that could be used to factor = 15 in a quantum 
computer. 

Designing the factoring circuit is the first step required for studying the impact 
of decoherence and the possibility of implementing error correction schemes. This 
is the purpose of the second part of the paper where we study how the coupling to 
an environment affects the functioning of the quantum factoring circuit. For this, 
we use an oversimplified model of the system-environment interaction. We assume 
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that this interaction takes place only at certain (randomly chosen) moments of time 
affecting only a few (randomly chosen) qubits which may spontaneously decay. 

After completing the design of the factoring circuit, and while we were work- 
ing on the numerical simulations to model dissipation, we became aware that a 
very similar gate array was recently developed by Vedral, Barenco and Ekert [21]. 
Our circuit produces the same final quantum state and has roughly the same re- 
quirements (in number of qubits and time steps) than the one described in Ref. 21 
(in that paper the authors did not attempt to analyze the impact of losses and 
decoherence on the performance of their quantum circuit, an issue which we an- 
alyze here). More recently Plcnio and Knight [22] used some of the conclusions 
of Ref. 21 (the number of required qubits and time steps) to discuss some of the 
limitations imposed by decoherence on the size of the numbers one could factorize 
using various physical setups. 

In Section 2 we briefly describe both the mathematical basis for Shor's algo- 
rithm and the basic steps a quantum computer would need to follow in order to 
implement it. In Section 3 we describe the quantum network for implementing 
modular exponentiation. We go from the coarser description where the circuit is 
just a black box to the fine grained picture where every component is dissected 
and built from elementary Toffoli gates. We analyze the architecture required to 
factor numbers of L bits and explicitly exhibit the circuit to factor iV = 15, which 
requires 28 qubits (the circuit to factor L bit numbers needs 5L + 8 qubits and 
involves a number of elementary gates which, for large L is close to 240L'^). In 
Section 4 we address the importance of decoherence and the possible strategies for 
error correction. We summarize our results in Section 5. 

2. Shor's algorithm 

In 1994, Peter Shor invented an algorithm for a quantum computer that could 
be used to find the prime factors of integer numbers in time. We will now briefiy 
review the most important aspects of Shor's algorithm and later consider the way 
to implement it in a quantum computer. 

The mathematical basis for Shor's algorithm is the following: (see Ref. 3,4,23): 
The goal is to find the prime factors of an integer number N. Instead of doing this 
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directly, the algorithm finds the order, r, of a number x. The order of x is defined 
as the least integer r such that a;'' = 1 (modN). Knowing r one can find the prime 
factors of N by using some results proved in Number Theory. Factorization reduces 
to finding r if one uses a randomized algorithm: as Shor shows in Ref. 4, choosing 
X at random and finding its order r, one can find a nontrivial factor by computing 
the greatest common divisor a =gcd(a;^/^ — 1, N). In fact, a is a nontrivial factor of 
N unless r is odd or a;^/^ = — 1 modN. As x is chosen at random, the probability 
for the method yielding a nontrivial prime factor of A?" is 1 — l/2^~^, where k is 
the number of distinct prime factors of N. 

In his seminal paper [3,4], Shor showed that a quantum computer could effi- 
ciently find the order r of the number x and, therefore, factorize N in polynomial 
time. Let us now describe the basic operation of this quantum computer. This 
requires two quantum registers, which hold integers represented in binary nota- 
tion. There should also be a number of work-qubits, which are required along the 
calculation but should be in a standard state (say |0)) both at the beginning and 
at the end of the calculation. The role of these work-qubits is very important and 
will be described in detail in the next section. For the moment, we will concentrate 
on describing the state of the computer before and after every major step of the 
program. For that purpose, we can forget for the moment these qubits. Apart from 
the quantum registers, there is also some classical information we should provide 
for operating the quantum computer. Thus, we will assume that the numbers N 
(the one we want to factor), x (chosen randomly mod A) and a randomly chosen 
q, which is such that A < q < 2A are part of the classical information available 
to the quantum computer. 

We start the process by preparing the first register in a uniform superposition 
of the states representing all numbers a < q — 1 (this can be done by a standard 
technique, i.e. rotating each individual qubit putting it in a superposition "^(|0) + 
|1))). The state of the computer is then 




(1) 



The next step is to unitarily evolve the computer into the state 
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Then, we Fourier transform the first register. That is, we apply a unitary- 
operator that maps the state l^^i) into 

^ q-lq-l 

1*2) = - X] X1^^P(^^^^^/^) 1^^ (modiV)). 
^ a=0 c=0 

The final step is to observe both registers (the method could be implemented 
observing just the first register but, following Shor [4], for clarity we assume both 
registers are observed). The probability for finding the state |c) \x^ (modA^)) is: 



P(c,a;'^ (modAT)) = - ^ exp(27rmc/q') 



2 



q 

where the sum is over all numbers < a < g — 1 such that x"' — x^{m.odN). This 
sum can be transformed into 

[{q-l-k)/r] 



P(c,a;^ (modiV)) = - ^ exp{27Tib{rc}q/q) 



^ 6=0 



2 



where {rc}q is an integer in the interval —q/2 < {rc}q < q/2 which is congruent to 
rc (modg). As shown by Shor, the above probability has well defined peaks if {rc}q 
is small (less than r), i.e., if rc is a multiple of q {rc = dq for some d < N). Thus, 
knowing q and the fact that the position of the peaks c will be close to numbers of 
the form dq/r, we can find the order r (using well established continuous fraction 
techniques) . 

There is no doubt that Shor's algorithm would work if a quantum computer 
could be built. However, to implement Shor's algorithm in a quantum computer one 
needs to explicitly construct the program. The procedure for Fourier transforming 
is well known and has been extensively discussed in several recent papers (see 
Ref. 4,17,23). To explicitly construct the unitary evolution that takes the state 
|\&o) into the state is a rather nontrivial task which we will describe in the 
next section [21]. 



3. Quantum network for modular exponentiation. 



We will present an array of quantum gates which maps the state |a) |0) into 
a) ® \x°' (modA?")) transforming the state l^^o) into l^'i). We describe the quantum 
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circuit using diagrams such as the one in Figure 1 which must be interpreted 
as representing the time evolution of the system with time flowing from left to 
right. Each line represents a single qubit, i.e. a two level system (a thick line 
will represent a bundle of qubits). In describing the circuit we will go in steps 
from the coarse description of Figure la (where the computer is a black box) 
to a fine grained description where the computer consists of a complex array of 
interconnected elementary gates. 

We will use Tofi^oli gates as "elementary" components and follow the notation 
of Ref. 24 denoting a gate acting on three qubits as A2. The action of a Tofi'oli 
gate on a computational state \xi,X2-:X^) (where G {0,1}) is A2|xi,X2,X3) = 
l^i, X2, 2:3© (xi AX2)) where © denotes the exclusive OR and A the AND operation 
between the Boolean variables x^. Thus, Tofi'oli gates are just controUed-NOT 
gates where the last qubit changes its state only if the two control qubits are set to 
1. It will also be convenient to use generalized Tofioli gates, with n control-qubits, 
which are denoted as A^j. Of course, all these gates can be constructed in terms of 
one and two-qubit operations, as explained in Ref. 24. The diagram representing 
the gate Kn is shown in Figure lb. 

To design a quantum circuit for modular exponentiation we should first notice 
that if the binary representation of a is a = X]F=0 then 



Thus, modular exponentiation is just a chain of products where each factor is ei- 
ther equal to 1 if = or equal to -tp^ if = 1. Therefore, the circuit is easily 
constructed if one is allowed to use a controlled multiplier as an auxiliary unit 
(which at this level, acts as a new black box) . In Figure 2 we show the basic archi- 
tecture of the array of controlled multipliers required for modular exponentiation. 
For the first multiplication the control qubit is ag and after each multiplication the 
control is moved to the next qubit. For this array to work we need to know all the 
numerical factors entering in (6) (thus, we must classically compute the numbers 
(modiV)). 

Our next step is to analyze the controlled multiplier. Given an input |/), this 
circuit, which we denote as Iljq{C)^ produces an output |/ * C(modA'")). The 
controlled multiplier is constructed using a smaller black box: a controlled modA/" 



n 




(6) 



i=0 
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adder. In fact, multiplication of two numbers / = X^f=o-^«2* ^ reduces to a 
sum of the form Yll=Q * (2*^). Thus, we just need to use as the control qubit 
in a controlled modA?" adder adding the number (2*C) (a circuit which we denote 
as S]s[{2'^C)). The numbers involved in the sum must also be provided as classical 
information (we need to classically compute all numbers 2^]^ , with i^j < L where 
L is the number of bits of N). In Figure 3 we show a controlled multiplier for 4-bit 
numbers. The same architecture can be used to multiply L-bit numbers. In that 
case, the controlled multiplier requires L + 1 work-qubits, whose state is set to zero 
before and after its operation. As we will see below, the controlled adder itself also 
requires some work-space which must be independent of the one used specifically 
for multiplication. 

As shown in Figure 3, n^(C) is schematically divided into three pieces. In all 
of them the work-qubits play an important role. The quantum state entering the 
circuit is |xo) = 1-^) ® \^)wb-: where / is the number stored in the input register 
and is the state of the work-qubits. The qubits 1/^) are used as control for 

the 5'7v(2*C modA^) adders and the result of the sum is temporarily written in the 
work-qubits. After this, the state is \xi) = \I) C)wb'- almost what we need, 

except for the fact that the input |/) also appears in the output state. Erasing this 
extra copy of the input is essential: Otherwise we would be keeping a record of the 
computational path affecting the interference pattern of the quantum computer 
(appart from forcing us to use an enormous ammount of space). The reversible 
erasure of the input is the purpose of the second part of the circuit. In designing 
this we followed well known techniques developed by Bennett [25] and described by 
Shor [4]. The procedure is as follows: We first consider the evolution operator U 
mapping the input \0)^\l')yj]j into |/'*C~^)®|/')^5, where is the multiplicative 
inverse of C (modA^) (the number satisfying C * — 1 (modA'^)). The operator 
needed in the second part of the multiplier is U"^. To convince ourselves that this 
is the case, we should notice that, as the input to the second part of the multiplier 
is Ixi) = \I) |/ * C)u;6> the output will be |x2) = U'^lxi) = |0) ® |/ * C)^^ 
(because, by construction, U satisfies U{\0) <8) |/ * C')^,^) = |/) |/ * C')w6 = |xi))- 
The circuit for U~^, shown in the figure, is just the specular image of the one used 
for the first part of the multiplier (switching the role of register and work-qubits). 
Finally, the multiplier is completed with a controlled swap that interchanges once 
more the register and work-qubits so that the final state of the work-qubits is 
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always 1 0)^,5. 



The circuit for doing controlled modA^ sums of a number X, which is stored 
in a quantum register, and a number Y, stored in a classical register, is called 
S]\[{Y). This circuit, for 5-bit numbers, is shown in Figure 4 (generalization to L bit 
numbers is straighforward) . The circuit for S]\[{Y) is built using a simple controlled 
adder, which we denote as S{Y) whose functioning will be explained below. The 
only difference between Sp^{Y) and S{Y) is that the former gives the output modulo 
N. Constructing a reversible circuit for computing the sum modA^ is not a trival task 
which is only possible because we know that the two numbers being added {X and 
Y) are both less than N (and therefore X + Y < 2N — 2). Without this information 
it would not be possible to compute modA^ reversibly without keeping unwanted 
records of the computation (since modA^ is not a one to one function). The input 
to the circuit is |xo) ~ \^) ® \0)wb- After the first adder, this is transformed to 
Ixi) = |X + F) |0)y;^. We then apply another simple adder adding the possitive 
number 2^+^ - N producing an output |x2) = |2^+^ + X + Y - N) \0)wb. The 
most significant bit (MSB) of 2^+'^ + X + y - AT is one (zero) if X + Y > N 
{X + Y < N). It is easy to realize that the opposite is true for the second MSB 
of the output. Thus if we use this qubit to control the inverse operation, we will 
add N only if X + Y < N. Therefore, after the third gate of the circuit shown in 
Figure 4, the first L qubits of the output always store the number A + C modAT. 
However, the L + 1- and L + 2-qubits, which are used to control the third gate, 
keep a record of the first result. As usual, this record must be reversibly erased 
and this can be done by using the following simple trick: We first add the possitive 
number 2^ -Y and notice that the MSB of the result 2^-Y+{X modAT) is always 
identical to the qubit used to control the third gate. Thus, we are done: we apply 
a control-NOT gate and then we undo the first sum (by adding Y). 

So far, we first explained modular exponentiation in terms of controlled multi- 
plication n^(C). Later, we explained n^(C) in terms of controlled modN sums 
S]^{Y)) and this circuit in terms of a simple adder S{Y). We will now present the 
gate array for the simple controlled adder S{X) which is best explained in terms of 
a smaller gate: a controlled two-qubit adder. This will be our smallest black box 
and, for clarity, we will explain here how it works. The two-qubit adder, denoted 
as S(cr) has four input qubits and a classical input bit a (i.e., there are two types 
of two-qubit adders, one for cr = and another for cr = 1). The first input qubit 
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is the control, the second qubit is zi, the third one is 12 and the fourth one is a 
work-qubit which is always set to at the input. At the output, the control qubit 
is unchanged, the first qubit changes into the Least Significant Bit (LSB) of the 
sum {ii + i2 + o'), the third one stores 12 and the fourth stores the MSB of the sum. 
In Figure 5 we can see how to build the gates E(0) and S(l) (and other useful 
simple gates) in terms of Toffoli gates. 

Using S(o") it is possible to construct a circuit mapping an input \X) into 
\X + Y). This is displayed in Figure 6 where, for simplicity, we assumed that 
both X and Y have 5 bits. For numbers of L bits the number of work-qubits 
required is L + 3. The quantum state entering the adder is |xo) = 1-^) ® |0)w5- 
This goes through the sequence of two-qubit adders S(y^) (we use Xi^Y^ G {0, 1} 
for the binary representation of X and Y) . After this chain of E-gates, the state is 
Ixi) = \X) ^ \X + Y)^Ij, which has an unwanted copy of the input. To reversibly 
erase this extra copy we apply the same method used in the multiplication: We 
first consider an auxiliary operator W that adds the possitive number Y = 2^ — Y 
(Y is known as the two's complement of Y and its binary representation is simply 
obtained from that of Y by interchanging zeros and ones and adding 1). The 
operator W satisfies W{\R) ® \Q)wh) = \R) ® + — l^)^^,^,. Therefore, its inverse 
is such that W~^|X + F)(8)|2^ + X)^^ = + (g) |0)^5 which is precisely what we 
need as the output of our circuit (the properties of W^^ simply follow from that 
of W which, by construction satisfies W\X + F) O lO)^^;, = |X + F) O + X)^^). 
Therefore, using W^^ after appropriately interchanging the role of the register and 
the work-qubits (and adding an extra work-qubit to store the qubit representing 
2^) we complete the controlled adder. The circuit for which is shown in 

Figure 6 is almost the specular image from the one used as the first part of the 
adder. The only difference is that instead of the first two qubit adder we can use 
a smaller circuit which only stores the LSB of the first sum (this circuit is shown 
in Figure 5). 

Having explained the essencial pieces of the quantum computer, let us now 
summarize what are its space and time requirements (i.e., the number of qubits 
and the number of elementary operations). As explained above, to factor an L 
bit number we need: L + 1 qubits as work-space for the controlled multiplier and 
L + 4 for controlled sums. The modAT circuit as well as the controlled swap require 
an extra work-qubit each. Adding the qubits required to store the two quantum 
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registers (2L + 1 qubits to store a in the first register and L qubits for the second 
register) we get a total of 5L + 8 qubits. Computing the number of elementary- 
operations is also possible. By inspecting our controlled adder one realizes that 
the number of elementary gates is aL + (3{L + 1) + (L + 2)7 where a, (3 and 7 are, 
respectively, the number of gates in a two-qubit adder, its inverse and the one in 
a swap circuit. Using the estimate a = /? = 3 one gets 12n + 17 operations for 
the sum. Using similar arguments to analyze the multipliers one finally concludes 
that the complete modular exponentiation circuit requires 240n^ + 484n^ + 182n 
elementary operations. For L = 4 this is about 2.5 10^. 



4. Losses and decoherence in a factoring computer 



Before analyzing the impact of dissipative effects on the quantum circuit it is 
convenient to introduce some notation. The quantum computer has a Hilbert space 
with a computational basis with states \ri,r2,wb) (where ri, r2 and wb are the 
bit-strings determining the states of the first register, the second register and the 
work-qubits respectively). We assume that the environment E has a Hilbert space 
spanned by a basis of states \e)g. The quantum state of the computer-environment 
ensemble can always be written as 

Mn,r2,wb,e,t) \ri,r2,wb)\e)£. 

ri,r2,wb,e 

The temporal evolution of the probability amplitude A{ri,r2,wb,e,t) is governed 
by the interplay between the quantum circuit described in Section 3 and the 
computer-environment interaction. At the initial time, when the computer is in 
state (1), the amplitudes are given by: 

A{ri, r2, wb, e,t=0) = -^S{r2, 0) S{wb, 0) S{e, 0). 

Here we assumed that the computer is initially uncorrellated with the environment 
which is taken to be in an unexcited state \0)g (we use 5(a, b) to denote Kronecker's 
delta function). If the computer evolves without interaction with the environment 
the amplitudes after the modular exponentiation circuit are: 

Aexact{ri,r2,wb,e,t ^ tf) = -^5{r2,y^^{modN)) S{wb,0) S{e,0). 
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However, when the computer interacts with the environment, the actual am- 
phtudes will deviate from the exact expression (9). To model this interaction we 
will use a very simple approach which incorporates the losses induced by the spon- 
taneous decay of the computer's qubits: The environment consists of a collection 
of two level systems i.e. a collection of "environmental qubits" (each £^j-qubit 
has an excited state and a ground state |0)^.). For simplicity we will assume 
that at a given time, a randomly selected computer qubit qi interacts with one 
of environmental qubits £^j. As a result of this sudden interaction correlations are 
established according to: 

where P2 = 1 ~ Pi- The interpretation of the evolution (10) is quite clear: If 
the computer qubit is in the state |l)g. it has a probability pi to persist and a 
probability P2 to decay into \^)q^ creating an excitation in the environment. On 
the other hand, if the computer qubit is in the state |0)g. nothing happens. It is 
worth mentioning that the decay rules (10) implicitly assume that the state used 
to represent the computational is the ground state (or, at least, has lower energy 
than the one used to represent the computational 1). In fact, the situation may 
be exactly the opposite in which case the rules (10) must be trivially modified by 
interchanging the roles of |l)q^ and |0)q^ (see below). More general evolution rules 
(such as the ones used in Ref. 14, which are best suited to analyze a noisy but 
almost losseless computer) will be studied elsewhere [26] . 

Thus, we can summarize the basic ingredients of our computer-environment 
model: i) It is caracterized by a randomly chosen sequence of times (ti,...,^^) 
which define the instants where the computer interacts with the environment (in 
between these times the computer evolves according to the unitary operators as- 
sociated with the quantum circuit described in the previous section), ii) At each 
time ti we randomly choose a computer qubit qi which is involved in a sudden in- 
teraction with an environmental qubit E^. iii) As a consequence of this interaction 
the computer-environment ensemble evolves according to the rules (10). Implicit 
in our assumptions is the validity of the simplifying Markovian approximation 
which assures that at every instant ti a different (and independent) environmental 
qubit £i is involved in the interaction. A simple way of visualizing this computer- 
environment model is by thinking of the times as the instants where there may 
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be a "branching" of the computational trajectory. Every time an environmental 
qubit is excited an "erroneous" computational trajectory emerges. At the end of 
the modular exponentiation circuit, the state vector of the computer-environment 
ensemble is written as in (7) with an amplitude which will not be given by (9). We 
already admitted that this is an oversimplification of reality (which has been used 
before to model losses in quantum computation [18]). 

We computed the amplitudes from the output state of the Fourier Transform 
circuit which follows modular exponentiation (the discrete FT circuit is described 
in the literature [4,5,17]). In Figure 7 results are presented for the probability 
for finding ri in the first register and r2 = 7 in the second register. The ideal 
result, ploted in Fig. 7(a), is obtained from eq. (5). This error-free curve has 
three sharp peaks, with a separation approximately equal to q/r = 130/4 (we 
deliberately choose a rather small value for q so that the small structure in the 
plots can be seen using a reasonable scale) . Provided we don't know the final state 
of the environment and the work-qubits (see below) the probability is 

PNEDin,r2) = 5^|A(ri,r2,w;6,e,t)|2. (11) 
■wb,e 

(the suffix stands for "no error detection", see below). This probability is shown in 
Figure 7(b) where we can see that the errors slightly widen the peaks and notably 
decrease their amplitudes. As the number of errors is increased it will be less and 
less likely to measure a value of ri located near a peak making the identification of 
the order r (obtained from the separation between peaks, as explained in Ref. 4) 
more and more difficult. The appearence of intermediate peaks is also evident in 
Fig. 7(b). Appart from the above probability we also calculated the probability 
for finding ri in the first register, r2 = 7 in the second and the work-qubits in the 
state |0)^^, i.e.: 

PED{ri,r2) = J2\Mn,r2,wb = 0,e,t)\'^. (12) 

e 

This is plotted in Fig. 7(c) where we see that while a noisy dc component (present 
in (b)) is supressed, the amplitude ratio between the misleading and correct peaks is 
increased. These plots correspond to simulations of the quantum computer running 
the program to factor N = 15 while coupled to an environment at a randomly 
chosen set of ten instants tj, (we use pi = P2 = 1/2). The modular exponentiation 
circuit requires about 2.5 10^ elementary (Toffoli) gates. This roughly correspond 
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to 10^ one bit operations for Cirac and ZoUer's cold ions computer [5], Thus, in 
that case we are considering an error rate of the order of 10~^, which is a rather 
optimistic figure. 

Our simulations not only can be used to visualize the importance of the en- 
vironmental interaction on the quantum algorithm but also to test simple error 
detection (and correction) schemes. The simplest of such schemes is probably the 
one based on checking the state of the qubits which are supposed to be in a known 
state. Our factoring program is suited for this purpose since the work-qubits must 
start and end in the state representing the computational 0. Two comments con- 
cerning error detection (and correction) are in order: First, by checking the final 
state of the work-qubits we are not able to detect a special class of errors which 
are produced by the decay of the qubits representing the first and second registers 
of the computer (ri and r2). Errors of that kind leave (most of the time) the 
work-qubits untouched but generate a misleading output (they are responsible for 
the intermediate peaks seen in Figure 7(c) which make the measurement of the 
order r a much more difficult task). Second, and more important, by measuring 
the final state of the work-qubits we are only able to the detect errors but not to 
correct (or prevent) them. 

Of course, it would be much better to have a method enabling us to prevent 
the errors from occuring. For this, the use of the watchdog effect [16] has been 
proposed. Thus, if some of the computer's qubits are supposed to be in a known 
state at some time, one could inhibit their decay by making a measurement on the 
known state. This method can indeed be applied here since the work-qubits are 
supposed to be in the state representing the computational at many intermediate 
instants of the computation. In fact, this is what happens after the action of each 
Il]\l{C) circuit and after the action of each controlled adder S]\i{C). For large L, 
the number of times one could measure the state of some of the work-qubits grows 
as L^. 

To test the efficiency of the watchdog effect as an error correction technique 
we slightly changed our computer-environment interaction model. In fact, we 
now assume that the decay rules are of the form (10) but with time dependent 
coefficients given by: 



pi(t) = exp(-7t), P2{t) = 1-Pi{t). 
14 



(13) 



In this way the decay probabihty for a qubit increases with time (measured from 
the start of the computation and, by convention, expressed in units of the total time 
required to run the program, i.e. t = 1 corresponds to the end of the computation). 
The decay rate 7 is taken to be 7 = 2.5 so that towards the end of the computation 
a qubit will have a high decay probability {p2{t = 1) fa 9/10). The assumption of 
an exponential decay is not essential (it is just a reasonable approximation which 
we addopt here for simplicity). 

To implement the watchdog we measure the state of the work-qubits at every 
instant when they are supposed to be in the computational 0. Every time we do 
this we reset the time in (13). Thus, a work-qubit will decay with probabilities 
given by (13) where the time will effectively be measured from the last instant in 
which the work-qubit was supposed to be in the computational state. On the 
other hand, the qubits involved in the first or second registers of the computer will 
have decay probabilities given by (13) with time counting from the begining of the 
computation. 

The effectiveness of the watchdog effect as an error prevention technique can 
be seen in Figure 8 where the exact probability is plotted together with the ones 
obtained with and without watchdog. Without using this method we get a very 
noisy probability with a substantial widening of the principal peaks. The amplitude 
of the central peak, which is about 0.1, is of the same order as the one shown in 
Fig. 7(b) (but the decay rules we are using here are more damaging than the 
ones we used before). Using the watchdog technique we substantially increase the 
amplitude of the main peaks (by a factor of four) and also eliminate almost all 
the noise. The only remaining spurious peaks are those produced by the decay 
of qubits involved in the first and second registers. They can not be eliminated 
using watchdog since their existence is not a consequence of a process affecting the 
work-qubits. 

5. Summary and outlook. 

The factoring circuit we presented is by no means optimal. Several improve- 
ments are possible to reduce the number of work-qubits. However, when designing 
a circuit for practical purposes one has to have in mind that the existence of work- 
qubits is not necesarily a burden. Our results show they can play a very useful role 
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allowing the use of the watchdog effect as an error prevention technique. It would 
be important to find the optimal balance minimizing the number of work-qubits 
but still allowing an efficient use of the watchdog method. 

The simulations we performed are rather simple and do not allow us to test 
the importance of other sources of problems for quantum computers. One of the 
most important sources of errors we excluded here is related with the fact that the 
elementary quantum gates are never 100% efficient. If we think of Cirac and ZoUer's 
[5] cold ions hardware, the elementary gates are built by applying a sequence of laser 
pulses on individual ions. If these pulses are not exact 7r-pulses (or 7r/2-pulses) 
the quantum gate will not be exactly the one we want. The corresponding unitary 
evolution operator Uj-^^i will have nonzero matrix elements in places where the 
exact quantum gate operator U^^^g^i has zero matrix elements. These imperfections 
may be rather important since their effects accumulate in time. To include this 
effects in our model one needs to follow the evolution of the computer's state 
vector in the 2'^^-dimensional Hilbert space. Even though our work enables us to 
explicitly write down the matrix C/j-ea^ every step of the calculation, we are not 
able to numerically simulate this because of space limitations (thus, simulating a 
quantum computer with qubits needs an exponentially large ammount of space 
in a classical computer) . Simulations of smaller versions of our circuit for modular 
exponentiation will be presented elsewhere [26]. 
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Figure 1: a) Black box description of the circuit for modular exponentiation. When N 
has four bits one needs nine qubits to represent a and fiveteen extra qubits to be used as 
workspace, b) A A4 Toffoli gate with 4-control bits: xi, X2, x^, X4. x^ ^ x^ ® {xi Ax2 A 
X3 A X4) 

Figure 2: The gate array used for modular exponentiation. Y""mod N is calculated by 
repeatedly multiplying the second register by Y'^"^mod N only if am = 1- Each box 
multiplies its input by Y-^'^mod N only if the control bit am is 1. 

Figure 3: a) The 3 stages of the controlled multiplier (mod N) Il]\^{C): first the input / 
is multiplied by C. Then / is reversibly erased and finally the result is swapped with the 
upper register, b) Multiplication by C is achieved by repeated addition of 2"^C mod N 
controlled by Im- This is done using the controlled mod N adders S^(2'"^C mod N). In 
the Figure we denote modA?" as %N . 

Figure 4: Addition mod N is achieved with 5 controlled adders: The first adds C to the 
input. The second "subtracts" N from a + C. The third operation adds N only if a + C 
is smaller than N . At this stage the first 4 bits have a + C mod N. The last two stages 
erase the record left in the 7th bit, whose state depends on the sign of a + C — A. 

Figure 5: The two-qubit adders S(cr) are shown in terms of Toffoli gates. They have four 
input and four output qubits. If the inputs are ctl, ii, 12 and 0, the outputs are ctl, the 
least significant bit (LSB) of ii +22 +^"7 ^2 ^-nd the most significant bit (MSB) of the sum. 
A swap gate is also shown that interchanges its two input qubits: ii and 12- 

Figure 6: a) Addition is performed in 3 stages: The first adds Y to the input X, the 
second interchanges X with X -\-Y and the last reversibly erases the input X. b) The first 
and last stages are shown in terms of the individual qubits and two-qubit adders S(a). 
Yq. . .Y^ are the bits in the binary representation of F. Y = 2^ — Y is used to erase X. 

Figure 7: Probability distribution for ri and r2 = 7. In the simulations N = 15, q = 130 
and pi = p2 = 1/2 V t G [0, 1]. a) Exact result, b) Result with ten decaying qubits at 
randomly chosen instants of time ti . . .tiQ. c) Probability distribution for ri, r2 = 7 and 
all work-qubits in their zero state. 

Figure 8: Probability distribution for ri and r2 = 7. In the simulation N — 15, q = 130 
and the decay rate 7 is chosen so that P2{t = 1) ^ 9/10. a) Exact result, b) Result with 
ten decaying qubits and using the watchdog effect on every work-qubit. c) Result with 
ten decaying qubits without using the watchdog effect. 
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